Question

I have a twisted proxy from here: Python Twisted proxy – how to intercept packets .

It prints the HTTP data, and I would like also to intercept and examine the raw IP datgrams. How to hook the callback for the IP packets?

http://twistedmatrix.com/documents/11.0.0/api/twisted.pair.ip.IPProtocol.html

Answer 1

Twisted doesn’t have a built-in friendly way to hook in a listener on a raw IP socket (SOCK_RAW). This is for several reasons:

• using SOCK_RAW can be tricky and it can work in non-obvious ways;
• in most environments, using such a socket requires elevated privileges;
• and the packets you actually get through a raw socket differ a lot between operating systems (e.g., you won’t get any raw TCP-protocol IP packets on *BSD/Darwin through a raw socket, even if you’re root).

The best way to capture raw datagrams in general, in a remotely portable manner, is with libpcap. Here is a link to someone who appears to have combined pcap and Twisted in a reasonably intelligent way; that may help.